0

Suppose that there are some hex contents in four-byte memory space.

According to some Internet resources I have, I heard that the contents of the memory should be read backward. So if in 0011AA33 contents are 96223346 in hex, in practical means, should it be rea 46332296? Or does this only apply to EIP>

user1613156
  • 69
  • 2
  • 7
  • 1
    Memory generally doesn't hold "hex contents". The memory of any typical general-purpose modern-day computer holds *bits*. They are NOT in hex. They can be shown as hexadecimal numbers, colored pixels, sound waves, text, or pretty much anything else but those are just representations. They are bits. – unwind Aug 30 '12 at 08:19
  • 4
    Read about endianness: http://en.wikipedia.org/wiki/Endianness – Ville Krumlinde Aug 30 '12 at 08:19
  • Depends on your CPU. Little-endian CPUs read it in the weird way and big-endian CPUs read left-to-right, in the same way you would read the four individual bytes. – tomsv Aug 30 '12 at 08:21

1 Answers1

3

This depends on how you interpret the data, and how you do the read. It's true that the x86 is a little-endian architecture.

This only matters when you read a multi-byte value, such as a 32-bit integer. Once a value is in the register, it will have the proper endianness if it was loaded using an operation aware of the size.

unwind
  • 391,730
  • 64
  • 469
  • 606
  • So except when I am trying to write into registers, can I not think of little endianness and write codes as normally? – user1613156 Aug 30 '12 at 08:41
  • @user1613156 You need to think about endianness only when you store eg. 32-bit integer and read it back as two 16-bit integers (to 16-bit registers), or vice versa. You don't need to worry about endianness when you write eg. 32-bit value to memory and then read it back to a 32-bit register. – nrz Aug 30 '12 at 20:54